From 677738cdaed0ce095fb634b6a8f1e55ea84d8991 Mon Sep 17 00:00:00 2001 From: Ashu Sharma Date: Thu, 19 Sep 2019 14:59:30 +0530 Subject: [PATCH] drm/msm/sde: Fix UBSan warnings in sde Fix warnings by accessing PGC and IGC c1 and c2 component arrays directly rather than through offset from color0 component lut address. Change-Id: I18df6c6a599ab8dc5f69c34c6977e289402e9e4f CRs-Fixed: 2531780 Signed-off-by: Ashu Sharma --- msm/sde/sde_hw_color_proc_v4.c | 15 +++++++++------ msm/sde/sde_hw_reg_dma_v1_color_proc.c | 26 ++++++++++++++++++-------- 2 files changed, 27 insertions(+), 14 deletions(-) diff --git a/msm/sde/sde_hw_color_proc_v4.c b/msm/sde/sde_hw_color_proc_v4.c index 80f3cb4616e0..f266683a96ea 100644 --- a/msm/sde/sde_hw_color_proc_v4.c +++ b/msm/sde/sde_hw_color_proc_v4.c @@ -150,7 +150,7 @@ void sde_setup_dspp_igcv3(struct sde_hw_dspp *ctx, void *cfg) struct drm_msm_igc_lut *lut_cfg; struct sde_hw_cp_cfg *hw_cfg = cfg; int i = 0, j = 0; - u32 *addr = NULL; + u32 *addr[IGC_TBL_NUM]; u32 offset = 0; if (!ctx || !cfg) { @@ -172,17 +172,20 @@ void sde_setup_dspp_igcv3(struct sde_hw_dspp *ctx, void *cfg) lut_cfg = hw_cfg->payload; + addr[0] = lut_cfg->c0; + addr[1] = lut_cfg->c1; + addr[2] = lut_cfg->c2; + for (i = 0; i < IGC_TBL_NUM; i++) { - addr = lut_cfg->c0 + (i * ARRAY_SIZE(lut_cfg->c0)); offset = IGC_C0_OFF + (i * sizeof(u32)); for (j = 0; j < IGC_TBL_LEN; j++) { - addr[j] &= IGC_DATA_MASK; - addr[j] |= IGC_DSPP_SEL_MASK(ctx->idx - 1); + addr[i][j] &= IGC_DATA_MASK; + addr[i][j] |= IGC_DSPP_SEL_MASK(ctx->idx - 1); if (j == 0) - addr[j] |= IGC_INDEX_UPDATE; + addr[i][j] |= IGC_INDEX_UPDATE; /* IGC lut registers are part of DSPP Top HW block */ - SDE_REG_WRITE(&ctx->hw_top, offset, addr[j]); + SDE_REG_WRITE(&ctx->hw_top, offset, addr[i][j]); } } diff --git a/msm/sde/sde_hw_reg_dma_v1_color_proc.c b/msm/sde/sde_hw_reg_dma_v1_color_proc.c index ca0e7becc94a..734302a19a2c 100644 --- a/msm/sde/sde_hw_reg_dma_v1_color_proc.c +++ b/msm/sde/sde_hw_reg_dma_v1_color_proc.c @@ -830,6 +830,7 @@ void reg_dmav1_setup_dspp_gcv18(struct sde_hw_dspp *ctx, void *cfg) struct sde_reg_dma_setup_ops_cfg dma_write_cfg; int rc, i = 0; u32 reg; + u32 *addr[GC_TBL_NUM]; u32 num_of_mixers, blk = 0; rc = reg_dma_dspp_check(ctx, cfg, GC); @@ -870,6 +871,9 @@ void reg_dmav1_setup_dspp_gcv18(struct sde_hw_dspp *ctx, void *cfg) return; } + addr[0] = lut_cfg->c0; + addr[1] = lut_cfg->c1; + addr[2] = lut_cfg->c2; for (i = 0; i < GC_TBL_NUM; i++) { reg = 0; REG_DMA_SETUP_OPS(dma_write_cfg, @@ -885,7 +889,7 @@ void reg_dmav1_setup_dspp_gcv18(struct sde_hw_dspp *ctx, void *cfg) REG_DMA_SETUP_OPS(dma_write_cfg, ctx->cap->sblk->gc.base + GC_C0_OFF + (i * sizeof(u32) * 2), - lut_cfg->c0 + (ARRAY_SIZE(lut_cfg->c0) * i), + addr[i], PGC_TBL_LEN * sizeof(u32), REG_BLK_WRITE_INC, 0, 0, 0); rc = dma_ops->setup_payload(&dma_write_cfg); @@ -981,7 +985,7 @@ void reg_dmav1_setup_dspp_igcv31(struct sde_hw_dspp *ctx, void *cfg) struct sde_reg_dma_setup_ops_cfg dma_write_cfg; struct sde_hw_dspp *dspp_list[DSPP_MAX]; int rc, i = 0, j = 0; - u32 *addr = NULL; + u32 *addr[IGC_TBL_NUM]; u32 offset = 0; u32 reg; u32 index, num_of_mixers, dspp_sel, blk = 0; @@ -1038,18 +1042,20 @@ void reg_dmav1_setup_dspp_igcv31(struct sde_hw_dspp *ctx, void *cfg) for (index = 0; index < num_of_mixers; index++) dspp_sel &= IGC_DSPP_SEL_MASK(dspp_list[index]->idx - 1); + addr[0] = lut_cfg->c0; + addr[1] = lut_cfg->c1; + addr[2] = lut_cfg->c2; for (i = 0; i < IGC_TBL_NUM; i++) { - addr = lut_cfg->c0 + (i * ARRAY_SIZE(lut_cfg->c0)); offset = IGC_C0_OFF + (i * sizeof(u32)); for (j = 0; j < IGC_TBL_LEN; j++) { - addr[j] &= IGC_DATA_MASK; - addr[j] |= dspp_sel; + addr[i][j] &= IGC_DATA_MASK; + addr[i][j] |= dspp_sel; if (j == 0) - addr[j] |= IGC_INDEX_UPDATE; + addr[i][j] |= IGC_INDEX_UPDATE; } - REG_DMA_SETUP_OPS(dma_write_cfg, offset, addr, + REG_DMA_SETUP_OPS(dma_write_cfg, offset, addr[i], IGC_TBL_LEN * sizeof(u32), REG_BLK_WRITE_INC, 0, 0, 0); rc = dma_ops->setup_payload(&dma_write_cfg); @@ -2231,6 +2237,7 @@ static int reg_dmav1_setup_vig_igc_common(struct sde_hw_reg_dma_ops *dma_ops, u32 lut_sel = 0, lut_enable = 0; u32 *data = NULL, *data_ptr = NULL; u32 igc_base = ctx->cap->sblk->igc_blk[0].base - REG_DMA_VIG_SWI_DIFF; + u32 *addr[IGC_TBL_NUM]; if (hw_cfg->len != sizeof(struct drm_msm_igc_lut)) { DRM_ERROR("invalid size of payload len %d exp %zd\n", @@ -2248,6 +2255,9 @@ static int reg_dmav1_setup_vig_igc_common(struct sde_hw_reg_dma_ops *dma_ops, if (lut_enable) lut_sel = (~lut_sel) && BIT(0); + addr[0] = igc_lut->c0; + addr[1] = igc_lut->c1; + addr[2] = igc_lut->c2; for (i = 0; i < IGC_TBL_NUM; i++) { /* write 0 to the index register */ index = 0; @@ -2260,7 +2270,7 @@ static int reg_dmav1_setup_vig_igc_common(struct sde_hw_reg_dma_ops *dma_ops, } offset = igc_base + 0x1B4 + i * sizeof(u32); - data_ptr = igc_lut->c0 + (ARRAY_SIZE(igc_lut->c0) * i); + data_ptr = addr[i]; for (j = 0; j < VIG_1D_LUT_IGC_LEN; j++) data[j] = (data_ptr[2 * j] & mask) | (data_ptr[2 * j + 1] & mask) << 16;